Red Hat Security AdvisoryRHSA-2017:2423
log4j security update
Released 2017-08-07 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) log4j-1.2.17-16.el7_4
- Red Hat Enterprise Linux Client Optional (v. 7) log4j-javadoc-1.2.17-16.el7_4, log4j-manual-1.2.17-16.el7_4
- Red Hat Enterprise Linux ComputeNode (v. 7) log4j-1.2.17-16.el7_4
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) log4j-javadoc-1.2.17-16.el7_4, log4j-manual-1.2.17-16.el7_4
- Red Hat Enterprise Linux Server (v. 7) log4j-1.2.17-16.el7_4
- Red Hat Enterprise Linux Server Optional (v. 7) log4j-javadoc-1.2.17-16.el7_4, log4j-manual-1.2.17-16.el7_4
- Red Hat Enterprise Linux Workstation (v. 7) log4j-1.2.17-16.el7_4
- Red Hat Enterprise Linux Workstation Optional (v. 7) log4j-javadoc-1.2.17-16.el7_4, log4j-manual-1.2.17-16.el7_4
Fixes 2 records
Priority CRITICAL 91
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, c…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.89358 · Published 2017-04-17 · Partial fix · 2.8.2 CWE-502
Priority CRITICAL 86
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening t…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.6998 · Published 2019-12-20 · Partial fix CWE-502
